You’re reading an issue of “The AI Economy,” my newsletter exploring the forces shaping the AI era—tracking how AI is rewriting business, work, technology, and culture. Subscribe to get expert insights and curated updates delivered straight to your inbox.
The definition of an AI agent has evolved rapidly since the term first entered the zeitgeist. The earliest versions were chatbots with better manners: systems that answered questions, drafted text, and waited for the next prompt. Tool use and function calling took them a step further, allowing models to query databases or call APIs, but humans still drove every exchange.
In the past couple of years, the software vendor-led wave of agents, from OpenAI’s Operator and Microsoft Copilot to Salesforce’s Agentforce, promised autonomy but mostly delivered supervised task execution within someone’s walled garden. Real autonomy did arrive, but on vendors’ terms. Cognition’s Devin and Anthropic’s Claude Code demonstrated that agents could carry out coding tasks end to end; Manus generalized the idea beyond code; and OpenAI’s ChatGPT Agent enabled multi-step execution. Each ran in a sandbox controlled by its maker, on a session that ended when the task did.
OpenClaw: The Agent at Arm’s Length
OpenClaw broke that pattern. Launched in November 2025 by developer Peter Steinberger, the personal AI assistant runs on a user’s own hardware, lives in the messaging apps they already use, and acts without waiting to be summoned. It became one of the fastest-growing open-source AI agents, with its GitHub repository receiving more than 377,000 stars. OpenClaw recast the agent as a proactive, always-on digital worker rather than a tool you open and close.
Despite its promise, significant security concerns slowed adoption. The project reportedly leaked plaintext API keys and credentials, and its skills marketplace was found to be riddled with malware. Researchers demonstrated how a prompt injection attack could backdoor a user’s machine through something as routine as an email. And in one widely circulated incident, the agent wiped out the entire email inbox of its own user, a Meta AI alignment director.
The OpenClaw ecosystem spawned imitators. Today, there are at least four “Claw” variants: NanoClaw, Nanobot, PicoClaw, and Nvidia’s NemoClaw. Each one attacks a different limitation of the original, from security architecture and hardware resource requirements to codebase complexity.
Tech companies have also been paying close attention to OpenClaw. Executives may not be saying the name on stage at their conferences, but the agent has started appearing on their slides, tucked into ecosystem diagrams and integration lists, a quiet acknowledgment of what early adopters were already experimenting with. These companies sensed an opportunity but haven’t figured out how to adopt the technology without inheriting its risks.
That uncertainty has created an opening for other claws. NanoClaw, a stripped-down variant built around the security discipline OpenClaw lacked, has drawn praise from OpenAI co-founder Andrej Karpathy, and in May, its creator turned down a $20 million buyout offer, raising $12 million in seed funding instead.
Microsoft + OpenClaw
None of it dented OpenClaw’s momentum. At this year’s Build conference, Microsoft handed the project its biggest endorsement yet, announcing that OpenClaw will power Scout, its new assistant for Microsoft 365, and that the agent will run natively on Windows. It’s a striking turn for Microsoft, given its chief executive, Satya Nadella, once said he couldn’t ship OpenClaw because “that would be considered Microsoft launching a virus,” even as he called it a fantastic innovation. What changed wasn’t his assessment of the technology. Microsoft believed it had built a cage strong enough to hold it.
To assuage organizations’ concerns about using an OpenClaw agent on their networks, Microsoft has placed it inside its Microsoft Execution Container (MXC), a policy-driven execution layer that “lets developers declare what an agent can access with containment boundaries enforced at runtime.” These protections are designed to keep OpenClaw from, say, erasing every file on the machine, with containment enforced at the operating-system level.
Nadella framed the containment work as what made the embrace possible. “It’s so wonderful to see OpenClaw come to Windows and have all that capability in terms of the security and that comfort to be able to have these long-running Agents and unmetered intelligence come together,” he remarked during his Build keynote.
For most people, though, the first encounter with OpenClaw will be Scout. It’s Microsoft’s first ‘Autopilot’ agent, the company’s label for agents that work autonomously over long stretches and meet enterprise compliance requirements. It also runs entirely within the user’s Microsoft 365 environment. “Scout works where you work, joining group chats and teams, handling threads in Outlook,” Nadella explained. But while OpenClaw on Windows can run either locally or in the cloud, Scout is cloud-based.
Its development shouldn’t be that surprising, though, given that Microsoft has openly telegraphed it for the past several months. Omar Shahine, who previously led Microsoft Word, leads the team tasked with building what he called “a new generation of proactive assistants, ones that lighten your load by taking on tasks end-to-end, and that can also step in proactively when they can help.”
For all the ways Microsoft reshaped OpenClaw to operate on its platform, the company is also giving back to the ecosystem it borrowed from. At Build, it said it is contributing its policy conformance system back to the project, which would let organizations running the open-source agent check their deployments against security and compliance requirements and produce an audit trail to prove it.
The logic behind Microsoft’s reversal appears to be competitive. Developers were already running OpenClaw on Windows, with or without Redmond’s blessing, and given where agentic development is headed, Microsoft had more to gain from making its platform the safest place to run the agent than from pretending it wasn’t there. And if OpenClaw is indeed the future, Scout and future Autopilots could help boost Microsoft 365 subscriptions.
Absorbing OpenClaw also buys Microsoft influence without ownership. By contributing its conformance system upstream, the company gets a hand in defining what a “secure” OpenClaw deployment looks like for every organization running it, which will help the project further stand out against other claws tackling the same issue.
Google Rebuilds OpenClaw in Its Own Image
Google is another Big Tech company that has let OpenClaw in. Sort of. In March, the company released a way for developers to integrate OpenClaw agents into Google Workspace, a tacit acknowledgment that users were bringing their own claws, whether Google built for them or not. Then, at its I/O conference in May, the company introduced its rival: Gemini Spark, an always-on agent that can compose emails, update study guides, and monitor credit card statements for hidden subscription fees, but runs entirely on Google’s stack, powered by Gemini 3.5 with the company’s Antigravity harness underneath. The capabilities are OpenClaw’s. The code, however, is not.
This suggests Google sees value in OpenClaw. The company is open to letting developers connect their agents to its apps, but it isn’t yet comfortable making the technology a native part of its platform. Or Google believes it has a better approach: an agent powered by its own model, with the security and governance controls already built into Workspace. There’s also a simpler explanation. Whatever agent sits in front of Gmail, Docs, and Calendar controls the relationship with the user, and Google has no intention of letting that be someone else’s software.
Google’s broader direction reinforces the point. The same month it previewed Spark, the company announced that its open-source Gemini CLI, an Apache-licensed tool with hundreds of contributors, would stop working with Google AI subscription plans on June 18, to be replaced by the closed-source Antigravity CLI. Even the Antigravity SDK, the developer-facing piece, is an open wrapper around a closed binary. While Microsoft moves toward the open agent project, Google is retiring its own open agent tooling.
The result, as one developer put it, is a vision in which “every agentic workflow you build runs on infrastructure Google controls, through interfaces Google designs, against models Google hosts.”
The split between the two companies comes down to how each wants to handle the same risk. Microsoft is offering an open foundation within a Microsoft-managed cage: build on the community’s project, contribute security work back, and sell the governance layer to enterprises on top. Google may be betting that customers would rather not touch the open project at all. One approach asks organizations to trust a caged version of software they’ve read alarming headlines about. The other asks them to trust Google with the whole thing.
Google has spent years building the full stack, its own chips, its own models, its own agent harness, so constructing a homegrown OpenClaw was the obvious move. Microsoft’s in-house models are far younger, and for most of the AI boom, its products have run on OpenAI’s technology. Neither side has the upper hand as it seems to be part of the ongoing debate about what’s better: open-source or closed-source.
Coming Soon: Meta
Facebook’s parent company could soon join the list of Big Tech companies drawing inspiration from OpenClaw. The Information reported that Meta is developing an OpenClaw alternative called Hatch. But unlike Microsoft’s Scout, this agent is aimed at consumers. The reason: OpenClaw is supposedly too technical for non-technical users. However, Hatch, or whatever name it’ll eventually go by, could perform functions similar to OpenClaw’s.
The Information further reported that Meta has tested Hatch on simulated versions of apps such as DoorDash, Reddit, Etsy, and Outlook. That said, consumers will have to really open up their wallets to use Hatch, as it could cost up to $200 per month. We could see it introduced next month.
What’s unclear is whether Meta will use a forked version of OpenClaw tailored for Hatch or will follow Google and use its in-house models to power the agent. As Engadget noted, Meta has a relationship with OpenClaw: its Chief Executive, Mark Zuckerberg, once offered Steinberger feedback and even tried to hire him—Steinberger ultimately went to work for OpenAI.
It’s Now an OpenClaw Agentic World
During his appearance at Microsoft Build, Steinberger celebrated Microsoft’s integration of OpenClaw. “I built OpenClaw to have access to everything—my files, machines, chats—always on and fully open source. That’s what makes it so powerful!” he said, while acknowledging that that’s what also makes companies nervous about the technology. Steinberger and his team of project contributors spent months working with Microsoft, OpenAI, GitHub, Nvidia, and others to create an OpenClaw that the enterprise would be more comfortable with. They added observability, auto-mode for permissions, and changed how access works. “It’s not all or nothing anymore,” he said. “You can pick which folder should be read-only, which ones should be hidden.”
Steinberger, however, envisions OpenClaw becoming something much bigger. He sees it as a movement, a community. That’s why he started the OpenClaw Foundation, a nonprofit designed to keep the agentic technology he created “open and neutral” and to work on any model or operating system. “We are entering an era of building these agents, more capability for the people who don’t code, and more power for those who do.”
A year ago, the world’s largest tech companies wouldn’t touch OpenClaw. Now Microsoft runs on its code, Google and Meta are rebuilding its blueprint, and all of them are arguing over who gets to define what it becomes. With validation from Big Tech, expect the floodgates to open over the coming year, with a wave of enterprise software vendors debuting their next-generation agents, powered by OpenClaw…or by one of its alternatives.
Disclosure: I attended Microsoft Build as a guest of the company, with my travel and expenses paid for. However, what I write reflects my own reporting and analysis. No one reviewed or approved this piece before publication.
